Phillips 66 Explosion & Fire – Pasadena, TX 1989

This is another great process safety report that is FULL of learning opportunities; a MUST READ for process safety professionals and those involved in their facility’s process safety efforts.  The last article discussed the famous 1974 Flixborough Explosion in the UK.  This catastrophe was a bit closer to home in Pasadena, TX and is considered to be “the final straw” that drove congress to revise the Clean Air Act in 1990, in which Congress mandated both OSHA and EPA to publish the PSM and RMP standard/rule.

PSM/RMP Background

After the 1984 chemical tragedy at Bhopal, India, EPA and other stakeholders began programs to improve emergency planning at the local level. In 1986, Congress adopted many aspects of these programs as the Emergency Planning and Community Right-to-Know Act (EPCRA). As its title indicates, EPCRA has two major concerns:

1. improved emergency planning at the local level, where emergency response occurs, and
2. improved information to the public about hazardous chemicals in the community.

EPCRA focuses on understanding hazards and planning for emergencies to ensure that when an accidental release occurs, the local responders will be able to take quick, effective actions to protect public health and the environment. EPA recognized, however, that for hazardous gases and liquids that rapidly become gases when released, emergency response was not enough. These hazardous substances move quickly into the community when an accident occurs; emergency response actions can limit the release, but may not be sufficient to protect the public. Public and environmental protection demands that these accidents be prevented or, if they do occur, that there be no adverse consequences. In 1986, EPA began a prevention program to work with industry and others to identify ways to improve safety practices. Congress, in 1990, included prevention requirements in its amendments to the Clean Air Act to address the dangers of hazardous chemicals released to air.

Under CAA section 112(r), EPA must adopt regulations for the prevention and detection of accidental releases of chemicals and response to releases that occur. On June 20, 1996, EPA published its final rule on accidental release prevention. The regulations (40 CFR part 68) require covered facilities to develop and implement a risk management program that includes analyses of offsite consequences of accidental chemical releases to the air, a five-year accident history, a prevention program, and an emergency response program. In addition, the facility must submit a risk management plan (RMP) that describes its hazards and prevention activities and indicates its compliance with the regulations.

ALSO, keep in mind it was under the Clean Air Act that Congress mandate the creation of the Chemical Safety Board.

OSHA investigations in 1984 and 1985 of all U.S. producers and users of methyl isocyanate and of a subsequent accident at a Union Carbide facility in West Virginia indicated the need to look beyond existing OSHA standards to the best company and industry control measures and systems for managing the hazards of the chemical processes.

OSHA developed a “system safety” approach to chemical accident investigations through a special emphasis program of inspections at 40 chemical-processing plants in 1985 and 1986 (ChemSep ). At the same time, the agency began to revise its existing standard for safe handling and storage of hazardous materials to include requirements for management systems that would ensure the safety of the chemical process. This effort was the precursor of the agency’s current rulemaking for a standard for Process Safety Management of Highly Hazardous Chemicals. The catastrophe at the Phillips Complex underscored the need for effective implementation of good safety management systems in the petrochemical industry and raised questions about diffused responsibility for employee safety at worksites where one or more contractors are engaged in work for a company. OSHA had addressed this issue at construction sites, but not at petrochemical plants like the Phillips Complex, where an engineering contractor was regularly employed to perform key maintenance operations and was involved in the October 1989 disaster. The Department of Labor therefore determined that OSHA’s investigation of this tragic accident would be broad in scope and would examine the underlying causes consequences and that the Department would report to the President with findings and recommendations.

The Investigation

OSHA investigated the causes of the accident concurrently with the investigation of possible violations of the Occupational Safety and Health Act (OSH Act). During the emergency response to the accident and during the investigation, OSHA coordinated with the U.S. Environmental Protection Agency (EPA) as well as other agencies. In the course of this extensive investigation, thousands of pages of documents relating to the facilities, the equipment, and company and contractor work practices were reviewed; scores of witnesses were interviewed; and critical pieces of evidence from the debris were subjected to laboratory and other tests.

OSHA’s investigation revealed that a number of company audits, which were done by Phillips’ own safety personnel as well as by outside consultants, had identified unsafe conditions, but had been largely ignored. The investigation further revealed an absence of effective management systems that resulted in the failure:

• to prevent the uncontrolled release of flammable vapors.
• to minimize the effects of a release of flammable vapors, including the elimination of possible ignition sources.
• to provide adequate fire protection.

Thus, a citation for willful violations of the OSH Act “general duty” clause was issued to Phillips with proposed penalties of $5,660,000. In addition, citations with proposed penalties of $6,200 were issued for serious violations in the areas of emergency response, emergency egress, inadequate pre-emergency planning, plant alarm systems, hazard communication, and respiratory protection.

A citation for willful violations with proposed penalties of $724,000 was issued to a Phillips maintenance contractor for failing to obtain the necessary vehicle and hot work permits when working in the polyethylene plant. Citations for serious violations with proposed penalties of $5,500 were issued for hazards involving inadequate respiratory protection and deficiencies in the company’s hazard communication program; other than serious violations involving mainly recordkeeping issues resulted in an additional $100 proposed penalty.

As a result of its findings in this investigation, the Department of Labor committed to a course of action directed toward preventing catastrophic chemical accidents. The following are the actions the Department pledged to undertake:

1. OSHA will expedite completion of its rulemaking requiring employers to implement comprehensive chemical process safety management plans for hazardous chemical processes.
2. OSHA will revise its current system for setting agency priorities to identify and include the risk of catastrophic events in the petrochemical industry.
3. OSHA will establish a catastrophe investigation protocol that will include plans, procedures, and an administrative framework to be activated in the event of a catastrophic accident.
4. The Department of Labor will work with EP A to develop a joint investigation strategy for catastrophic chemical accidents that affect workers within the plant and the public and the environment outside the plant.
5. OSHA will employ all means at its disposal to ensure that every establishment in the petrochemical industry implements technologies and safe work practices that are widely accepted and generally used by the industry and its contractors. The agency will encourage the petrochemical industry to incorporate new technologies into chemical processes that would decrease the likelihood of a workplace accident.
6. OSHA will sponsor a conference of industry, labor and government leaders on the lessons learned from the Phillips disaster. The results of the study on the petrochemical industry’s practice of contracting out maintenance work will be presented. Representatives from other Federal agencies and foreign countries will be invited to participate in a discussion of ways to improve worker safety and health in the petrochemical industry.
7. OSHA will urge agencies involved in the collection of information on chemical accidents and incidents to establish an interagency working group to review available data systems with a view to including more information on the causes of chemical accidents.

EPA, as a part of its Chemical Accident Prevention Program, conducted a chemical safety audit of the Phillips Complex on November 6-7, 1989. OSHA staff participated on the EPA audit team. Other agencies contributing to and participating on the audit team were the Texas Air Control Board, the Texas Department of Health, and the local emergency planning committee. The purpose of this audit was to assess the facility’s chemical emergency preparedness and prevention procedures and to determine the potential for and consequences of releases that have a potential impact off site. Detailed information on the facility was collected from documents provided by Phillips and through discussions with company staff. This information included a description of the physical characteristics of the site, emergency preparedness and planning activities, community emergency response planning, public alert and notification procedures, safety and loss prevention activities, and accidental release investigations. A list was compiled of the hazardous chemicals at the site, and the procedures for handling and processing these chemicals were reviewed. Systems for monitoring the operation of the process and equipment and for mitigating the effects of process upsets were also reviewed. Recommendations were developed for emergency response planning, equipment for monitoring hazardous substance releases, reporting and notification procedures for chemical releases, alarm equipment, and employee evacuation training. The EPA recommendations were transmitted to Phillips in January 1990. The audit report is available from the EPA.

The following is a summary of the major findings of OSHA’s investigation of the accident. These findings provide the basis for the Phillips citations:

1. A process hazard analysis or other equivalent method had not been utilized in the Phillips polyethylene plants to identify the process hazards and the potential for malfunction or human error and to reduce or eliminate such hazards.
2. Phillips’ existing safe operating procedures for opening lines in hydrocarbon service, which could have prevented the flammable gas release, were not required for maintenance of the polyethylene plant settling legs. The alternate procedure devised for opening settling legs was inadequate; there was no provision for redundancy on DEMCO3 valves, no adequate lockout/tagout procedure, and improper design of the valve actuator mechanism and its air hose connections.
3. An effective safety permit system was not enforced with respect to Phillips or contractor employees to ensure that proper safety precautions were observed during maintenance operations, such as unblocking reactor settling legs.
4. There was no pemtanent combustible gas detection and alarm system in the reactor units or in adjacent strategic locations to monitor hydrocarbon levels and to provide early warning of leaks or releases.
5. Ignition sources were located in proximity to, or downwind (based on prevailing winds) from, large hydrocarbon inventories. Ignition sources also were introduced into high hazard areas without flammable gas testing.
6. Buildings containing personnel or vital control equipment were not separated from process units in accordance with accepted engineering principles or designed with sufficient resistance to fire and explosion.
7. Ventilation system intakes for buildings in close proximity to, or downwind from, hydrocarbon processes or inventories were not designed or configured to prevent the intake of gases in the event of a release.
8. The fire protection system was not maintained in a state of readiness necessary to provide effective firefighting capability. Unknown to the fire chief, one of three emergency standby diesel-powered water pumps had been taken out of service, and another was not fully fueled, with the result that it ran out of fuel during firefighting activities. Further, electric cables supplying power to regular service fire pumps were not located underground, thereby exposing them to blast and fire damage.

Citations were also issued to Phillips for serious violations of other OSHA standards, with additional proposed penalties of $6,200. Among these were failure to provide for emergency evacuation, an inadequate respirator program, and lack of compliance with OSHA’s Hazard Communication Standard with respect to company and contractor personnel.

 

The Explosion and Fire

The fire and explosion on October 23, 1989, at the Phillips 66 Company’s Houston Chemical Complex resulted from a massive release of process gas, a mixture of four flammable chemicals–isobutane, ethylene, hexene and hydrogen–which traveled to an unidentified ignition source and exploded with the force of 2.4 tons of TNT .  

The release occurred during maintenance operations on a polyethylene reactor in Plant V of the complex.  Two of the six workers on the maintenance crews in the immediate vicinity of the reactor leg where the release occurred were killed, together with 21 other employees of the facility. Debris from the plant was found 6 miles from the explosion site. Structural steel beams were twisted like pretzels by the extreme heat generated during the fire. Two polyethylene production plants at the Phillips site, covering an area of approximately 16 acres, were completely destroyed.

In the months preceding the explosion, according to the sworn testimony of an employee, there had been several small fires, and the alarm had sounded as many as four or five times in one day. A siren was used to warn company and maintenance contract workers to vacate the plant. Some of the workers in the finishing building may not have heard the siren because of the ambient noise level inside the building. Consequently, those employees may not have been aware of the impending disaster. The employees in the immediate area of the release began running as soon as they realized the gas was escaping.  

High-density polyethylene is manufactured in Plants IV and V of the Phillips Complex from ethylene gas dissolved in isobutane, which is reacted in long pipes under elevated pressure and temperature. Various chemicals are added to the process to modify the polyethylene to meet the desired product characteristics. This combination of process gases at elevated pressure and temperature is extremely flammable. The dissolved ethylene reacts with itself to form polyethylene particles that gradually come to rest in settling legs (see Figure 3), where they are eventually removed through valves at the bottom. At the top of each of these legs, there is a single ball valve where the legs join with the reactor pipes. The valve is kept open during production so that the polyethylene particles can settle into the leg.  

In the Phillips reactor, the plastic material frequently clogged the settling legs.  When this happened, the valve for the blocked leg was closed, the leg disassembled, and the block removed. During this maintenance process, the reaction continued and the product settled out in the legs that remained in place. If the valve were to open during a cleaning-out operation, there would be nothing to prevent the escape of the gas to the atmosphere. 

OSHA ‘s investigation concluded that on October 23 more than 85,000 pounds of highly flammable gas were suddenly released through an open valve on the settling leg. In less than 2 minutes, the gas rapidly found its way to an ignition source and exploded. The explosion and ensuing fire occurred at approximately 1:00 p.m. Estimates of the time that elapsed from the release of the gas to the initial explosion ranged from 90 seconds to 2 minutes. A second explosion occurred 10 to 15 minutes later when two isobutane storage tanks exploded. Each explosion damaged other units, creating a chain-reaction of explosions. One witness reported hearing ten separate explosions over a 2-hour period.  The accident resulted in significant loss of life and numerous injuries and caused property damage of nearly $750 million. The most significant and tragic loss occurred in the workplace. Twenty-two bodies were recovered at the accident site; a 23rd victim died off site at a local hospital. The mixture of flammable gases ignited, dissipated, and thus did not pose a threat to the public or the environment.  The injuries that occurred outside the complex were related, for the most part, to the debris of the explosion. All of those who died at the scene were within 250 feet of the point of initial release.

The Immediate Response
The Phillips fire brigade provided the initial emergency response, which included administering first aid to injured employees and fighting the fire with onsite equipment. The effort was augmented by local emergency response units including fire, police, and ambulance and by the Channel Industries Mutual Aid organization (ClMA). ClMA, a cooperative of approximately 106 members in the Houston area, which included industrial facilities, municipal fire departments, the U .S. Coast Guard, the County Sheriffs Department, and the County Fire Marshal’s Office, was established to provide assistance to its members in emergency situations. This assistance included trained firefighting, rescue, and first-aid personnel and equipment.  Command of the site and coordination of the response were under the control of the Phillips Complex fire chief.  EPA Region 6, headquartered in Dallas, was notified of the incident by the National Response Center at 3:27 p.m. after a concerned citizen made the initial report of the accident at 3:14 p.m. EPA Technical Assistance Team representatives were on scene within the hour and performed air monitoring at several locations downwind from the facility. No hydrocarbon concentrations above background levels were found. An EP A on-scene coordinator arrived at 4:30 p.m. to provide technical assistance to Phillips in emergency response procedures, and in accordance with the National Contingency Plan–the national emergency response plan developed by the 14-member interagency (NRT)–to ensure that the response measures were adequately protective of public health and the environment.  Phillips officials notified the Texas Air Control Board, the Harris County Pollution Control Board and the Community Awareness Emergency Response Program immediately following the explosion. The Federal Aviation Administration took steps to limit air traffic in the vicinity of the site, and the U.S. Coast Guard temporarily closed the Houston Ship Channel.

The Phillips Complex did NOT have a dedicated water system for fighting fires. Water for that purpose came from the same water system that was used for the chemical process. Consequently, when the process water system was extensively compromised by the explosion, the plant’s water supply for fighting fires was also disrupted. Fire hydrants were sheared off in the blast, and because of ruptures in the system, water pressure was inadequate for firefighting needs. It was necessary to lay hose to remote water sources–settling ponds, a cooling tower, a water treatment plant, and a water main at a neighboring plant. Of the three backup diesel pumps that could have been used to provide water pressure to fight the fire, one had been taken out of service and was therefore unavailable, and another soon ran out of fuel and it, too, went out of service. Electric cables supplying power to regular service fire pumps were damaged by the fire, and those pumps were rendered inoperable. Nonetheless, the fire was brought under control within approximately 10 hours, with the help of several Phillips Complex fire trucks, which were able to pump foam on the fire, and with the assistance of firefighting equipment
brought to the site by CIMA members and local fire departments.

The U.S. Coast Guard and Houston fireboats evacuated more than 100 people from the facility and transported them across the Houston Ship Channel. These people had been in the Administration Building and would have had to cross the area of the explosion to reach safety had not the U .S. Coast Guard and fire department vessels been on the scene.

CAUSES of the accident

The primary cause of the explosion and fire on October 23, 1989, was the release of flammable process gases which moved rapidly through the facility to an ignition source. The gases – a mixture of four highly flammable substances were released through an open valve between a reactor and a product settling line located in Plant V, one of two active polyethylene plants in the Complex.

At the time of the event, a settling leg was undergoing a regular maintenance procedure, the removal of a solidified polyethylene blockage. Under Phillips’ written procedures for this maintenance function, which was usually performed by a contractor, Phillips’ operations personnel were required to prepare the product settling leg for the maintenance procedure by isolating it from the main reactor loop before turning it over to the maintenance contractor to clear the blockage. On Sunday, October 22, a contractor crew began work to unplug three (3) of the six (6) settling legs on Reactor 6. According to witnesses, all three (3) legs were prepared by a Phillips operator and were ready for maintenance, with the reactor isolation valve in the CLOSED position and the air hoses, which are used to rotate the valve, disconnected. Number 1 leg was disassembled and unplugged without incident. At approximately 8:00 a.m. on Monday morning, work began on Number 4 leg, the second of the three plugged legs.  

The contractor crew partially disassembled the leg and managed to extract a polyethylene “log” from one section of the leg. Part of the plug, however, remained lodged in the pipe 12 to 18 inches below the reactor isolation valve. At noon, the contractors went to lunch. Upon their return, they resumed work on Number 4 leg. Witnesses then report that a contractor employee was sent to the reactor control room to ask a Phillips operator for assistance. A short time later, the initial release occurred. Five individuals reported actually observing the vapor release from the disassembled settling leg. Because of the high operating pressure, the reactor dumped approximately 99 percent of its contents (85,200 pounds of flammable gases) in a matter of seconds. A huge unconfined vapor cloud formed almost instantly and moved rapidly downwind through the plant.

There were several potential ignition sources:

• a small diesel crane used by the contractor, but not in operation at the time of the accident
• an operating forklift
• an open-flame gas fired catalyst activator
• hotwork operations
• 11 vehicles parked nearby
• ordinary electrical hear in the control building and finishing building

Within 2 minutes, and possible as soon as 90 seconds, the vapor clound came into contact with an ignition source and was ignited.  Two (2) other major explosions occured subsequently, one about 10-12 minutes after the initial explosion when two (2) 20,000 gallon iso-butane storage tanks exploded and another when a polyethylene plant reactor catastrophically failed about 20 to 45 minutes into the incident.

After the explosion, a physical examination of the actuator mechanism for the isolation valve showed, and confirmed by FBI labratory testing, that the valve was OPEN during the incident.  The tests showed that the air hoses that supplied the air pressure (by which the actuator mechanism opened or closed the valve) were improperly connected in a reversed position. The hoses, connected in that way, would open a closed valve even when the actuator switch was in the closed position.  

Phillips 66 Corporate Safety procedures and standard industry practices required back-up protection in the form of a double valve or blind flange insert whenever a process or pipe in hydrocarbon service is opened.  However, at the local level this requirement had not been incorporated into the procedures.  Consequently none was used on October 23.

Additionally the following unsafe conditions existed:

1. The reactor isolation valve actuator mechanism did not have its “lockout mechnasim” in place
2. the hoses that supplied air to the actuator could have been connected at anytime 
3. the hose connections for the “open” and “closed” were identical, thus allowing the hoses to be cross-connected and allowing the valve to be opened when the operator might have intended it to be closed.
4. the air supply valve for the actuator mechanism air hoses were in the OPEN position so that air would flow and cause the actuator to rotate the isolation valve when the hoses were connected.

The valve lockout system for this maintenance operation was inadequate to prevent someone from inadvertently or deliberately opening the valve during a maintenance procedure.   

Other conditions at the complex, though not causes of the accident, exacerbated its consequences. As noted, the lack of a water system dedicated to firefighting, and deficiencies in the shared system, contributed to the intensity and duration of the fires that followed the explosion. The force of the blasts ruptured water lines and adjacent vessels containing flammable and combustible materials. The ruptured water lines could not be isolated to restore water pressure because the valves to do so were engulfed in flames.

The site layout and the proximity of normally high occupancy structures, such as the control room and the finishing building, to large capacity reactors and hydrocarbon storage vessels also contributed to the severity of the event.  The large number of fatally injured personnel was due in part to the inadequate separation between buildings in the complex. The distances between process equipment were in violation of accepted engineering practices and did not allow personnel to leave the polyethylene plants safely during the initial vapor release; nor was there sufficient separation between the reactors and the control room to carry out emergency shutdown procedures. The control room, in fact, was destroyed by the initial explosion. Of the 22 victims’ bodies that were recovered at the scene, all were located within 250 feet of the vapor release point; 15 of them were within 150 feet.

To learn more from this tragedy, use the links below to download the full report in segments.

Introduction (pdf)

Chapters 1-3 (pdf)

Chapters 4-10 (pdf)

Chapters 11- End (pdf)